CVE-2026-6091: Partial-chain verification accepts untrusted intermediate as trust anchor
Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An attacker could present a chain that ends at an intermediate they control and have it accepted as valid. This affects the OpenSSL compatibility certificate-path-building path (wolfSSLX509verifycert / X509STORE, OPENSSLEXTRA) when the X509VFLAGPARTIALCHAIN verify flag is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the X509_V_FLAG_PARTIAL_CHAIN verify flag is NOT enabled so certificate-path building does not treat an untrusted peer-supplied intermediate as a trust anchor.
wolfSSL/OpenSSL compatibility certificate path verification (wolfSSL_X509_verify_cert / X509_STORE, OPENSSL_EXTRA) X509_V_FLAG_PARTIAL_CHAIN = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6091?
CVE-2026-6091 has a medium severity level with a CVSS score of 4.0.
How do I fix CVE-2026-6091?
To fix CVE-2026-6091, update OpenSSL or wolfSSL to the latest version that addresses this vulnerability.
What impact does CVE-2026-6091 have on my system?
CVE-2026-6091 can allow an attacker to present a forged certificate chain accepted by your system, compromising trust.
Which software is affected by CVE-2026-6091?
CVE-2026-6091 affects OpenSSL and wolfSSL implementations.
How was CVE-2026-6091 discovered?
CVE-2026-6091 was identified due to issues with partial-chain certificate verification that improperly accepted untrusted intermediate certificates.